CVE-2026-23306

Description

A flaw was found in the Linux kernel, specifically within the pm8001 SCSI driver and the libsas library. An incorrect return value in the pm8001_queue_command() function, when a physical device is down or gone, can lead to a double free vulnerability. This occurs because the function frees a Serial Attached SCSI (SAS) task but then returns an error, causing the libsas layer to attempt to free the same task again. This double free can result in system instability or a denial of service (DoS).

Statement

This flaw affects systems using PMC-Sierra PM8001 SAS/SATA host bus adapters. The double-free occurs when a device goes offline during command processing. The incorrect return value causes libsas to free an already-freed task structure. While primarily a DoS issue, double-free vulnerabilities can potentially be exploited for code execution in some circumstances.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score5.5N/A7.8
Attack VectorLocalN/ALocal
Attack ComplexityLowN/ALow
Privileges RequiredLowN/ALow
User InteractionNoneN/ANone
ScopeUnchangedN/AUnchanged
ConfidentialityNoneN/AHigh
Integrity ImpactNoneN/AHigh
Availability ImpactHighN/AHigh

Vector

Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.